How to share and manage searches across Splunk instances?

[dougmartin]

We have multiple Splunk instances (webui & indexer) that we manage. They're currently kept isolated by design. However, we're trying to figure out the best way to share searches and distribute searches between the instances with minimal effort.

Basically, we want to create a search/report on SplunkB and see it on SplunkA & SplunkC within a short time frame (0-15minutes would suffice). We'd also like the searches from SplunkA to show up on B&C.

Hopefully that makes sense.

[woodcock]

Probably the easiest way is to make sure that everybody savers the searches, then upgrades the permissions of the saved searches to "app" so that each set of associated searches/alerts/KOs is contained inside specific apps. Then use this app to export the entire mess as a single zip file that can be installed on the other search head:

https://splunkbase.splunk.com/app/2613/

The only real downside is that this is a 1-way sync, not a 2-way, but I am assuming that you are talking about Dev->Production.

[dougmartin]

Yup, the 1-way sync would be a start.
A little worried about overwriting saved searches but something has to give since there is no great way to do this otherwise.